Jupiter X Core: critical auth bypass in WordPress

What it is and who is affectedThe Jupiter X Core plugin for WordPress carries a critical authentication bypass, tracked as CVE-2026-106013. It affects...

What it is and who is affected

The Jupiter X Core plugin for WordPress carries a critical authentication bypass, tracked as CVE-2026-106013. It affects all versions up to and including 4.61.0 and sits in the plugin's Twitter/X social login handler, inside the verify_twitter_callback function.

The flaw is classified as CWE-287 (improper authentication) and scores CVSS 3.1 9.8, CRITICAL (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). In practice: no credentials, no user interaction, and full impact on confidentiality, integrity and availability. The NVD published it on 28 October 2026.

The mechanism is subtle. When a visitor signs in with X, the handler exchanges their oauth_verifier for an access token but never calls setOauthToken() to attach those credentials to the TwitterOAuth client. The following account/verify_credentials call therefore stays signed with the site operator's stored Access Token and Access Token Secret. X returns the profile of the application owner, not the visitor's, and the plugin then authenticates a WordPress account by matching that owner's email address through wp_set_auth_cookie(). An unauthenticated attacker ends up logged in as the WordPress user whose email belongs to the X app owner, which is normally the site administrator.

Who should look at this: any WordPress site on a Jupiter X theme setup with Jupiter X Core installed, especially SMEs, online shops and businesses across Spain and Catalonia — Barcelona, Lleida, Tarragona, Girona — running their own servers or a small IT team. If the X social login was never configured, exposure is lower, but the plugin should still be inventoried and updated.

Why it is urgent

At the time of writing, CVE-2026-106013 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public record of it being exploited in the wild. That is not a reason to relax. A 9.8 authentication bypass on a widely deployed WordPress plugin is exactly the kind of target that automated scanners pick up quickly, and the reward for a successful attempt is administrative access to the site.

Consider what an administrator session gives an attacker: theme and plugin editors, user management, database access through the dashboard, the ability to plant backdoors or redirect checkout traffic. For an ecommerce site built on WooCommerce, that can mean card data exposure, fraudulent orders and a GDPR notification obligation. The window between public disclosure and mass scanning is short, and the cost of being late is measured in days of downtime and reputational damage.

What to do today

Check whether the plugin is installed and at which version. In the WordPress dashboard, open the plugins list and read the version next to Jupiter X Core. Anything at or below 4.61.0 is in scope. Also check sites where it was installed and later deactivated but not removed.
Apply the fix indicated in the vendor's advisory. The NVD entry points to the plugin's public changeset and to the Wordfence threat intelligence record; follow the update path those sources describe rather than guessing a version number. If an immediate update is not possible, disable the Twitter/X social login option until it is.
Look for signs of intrusion. Review WordPress users for accounts you do not recognise, check recent login timestamps and audit the administrator role. Compare plugin and theme files against a clean copy, and inspect server logs for requests hitting the social login callback endpoint from unexpected addresses.
Reduce what is exposed to the internet. Remove social login providers you do not actively use, restrict wp-login.php and wp-admin where your workflow allows it, enforce strong passwords and two-factor authentication for administrators, and keep an off-site backup you have actually tested restoring.

If the site has already been compromised, updating the plugin is only the first step: the attacker's session and any planted files must be removed before the site can be trusted again.

How a cybersecurity team like ALMC can help

Situations like this one are rarely about a single plugin. They are about not knowing which versions are running across which sites, and finding out too late. ALMC's cybersecurity work for businesses starts with an audit and pentesting to map real exposure, followed by hardening of servers and CMS installations, and ongoing maintenance and patching of WordPress, PrestaShop and Joomla so that advisories like CVE-2026-106013 are acted on before they become incidents.

When something does go wrong, the team handles incident response and repair of hacked websites: containing the intrusion, cleaning the installation, closing the entry point and restoring service. For SMEs and online shops in Lleida and across Catalonia that run their own infrastructure with a small IT team, that combination of preventive hardening and hands-on response is usually the difference between a quiet patch cycle and a very expensive week.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.